Executive Summary

This vulnerability is a second-order Server-Side Request Forgery (SSRF) in the OpenApi service of JeecgBoot versions up to 3.9.1. It occurs because the application does not properly validate or authorize URLs submitted to the /openapi/add endpoint, allowing authenticated users to inject malicious URLs into the originUrl database field.

Later, when the /openapi/call/{path} endpoint is accessed, the application retrieves the unvalidated URL and makes an outbound HTTP request to it. This enables attackers to make the server send requests to arbitrary internal or external resources, potentially bypassing network segmentation and accessing sensitive internal services.

The vulnerability arises from missing permission checks and inadequate URL validation in the OpenApiController.add() and OpenApiController.call() methods.

• Step 1: An attacker sends a POST request to /openapi/add with a malicious URL in the originUrl field.
• Step 2: The attacker triggers the SSRF by accessing /openapi/call/{path}, causing the server to fetch the injected malicious URL.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts including allowing attackers to bypass network segmentation and scan internal services that are not normally accessible from outside.

Attackers can exfiltrate sensitive data such as cloud metadata or local credentials by forcing the server to make requests to internal or protected resources.

Because the exploit can be launched remotely by authenticated users, it increases the risk of unauthorized access and data leakage within your environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring and testing the behavior of the /openapi/add and /openapi/call/{path} endpoints in JeecgBoot up to version 3.9.1. Specifically, detection involves checking if it is possible to inject and trigger malicious URLs via these endpoints.

• Send a POST request to /openapi/add with a crafted payload containing a malicious URL in the originUrl field to see if the server accepts and stores it.
• Trigger the SSRF by sending a request to /openapi/call/{path} where {path} corresponds to the injected entry, and observe if the server makes an outbound HTTP request to the malicious URL.
• Use network monitoring tools to detect outbound HTTP requests from the server to unexpected internal or external addresses after triggering the /openapi/call/{path} endpoint.
• Example command using curl to test injection: curl -X POST -H "Content-Type: application/json" -d '{"originUrl":"http://malicious.example.com"}' http://target-server/openapi/add
• Example command to trigger SSRF: curl http://target-server/openapi/call/{path}

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the affected JeecgBoot component to a version where the vulnerability is fixed once the vendor releases the patch.

Until an official fix is available, restrict access to the /openapi/add and /openapi/call/{path} endpoints to trusted and authenticated users only, and implement strict input validation and authorization checks to prevent injection of malicious URLs.

Additionally, monitor and block unexpected outbound HTTP requests from the server to prevent exploitation of SSRF.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in JeecgBoot allows attackers to perform server-side request forgery (SSRF), which can lead to unauthorized access to internal services and exfiltration of sensitive data such as cloud metadata or local credentials.

Such unauthorized data access and potential data leakage could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive data to prevent unauthorized disclosure.

Because the exploit enables attackers to bypass network segmentation and access internal resources, it increases the risk of data breaches, which are subject to regulatory reporting and penalties under these standards.

Therefore, until the vulnerability is fixed, affected systems may be at higher risk of non-compliance with common security and privacy regulations.

Useful 0 Not Useful 0